Directory traversal vulnerabilities in Interstage Application Server(CVE-2007-0450). March 3rd, 2009

Notes on using this web page

1. Background and Detected problem(s)

Directory traversal vulnerabilities have been discovered in the Servlet Service based on Tomcat4.1 or Tomcat5.5.

Exploitation of these vulnerabilities could allow unauthenticated users to access web applications that have restricted access.
However, they cannot access the system files by traversing directory hierarchy from the directory where a web application is deployed.

This information is derived from the vulnerability on the following web site:
CVE-2007-0450: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0450

2. Method to temporarily avoid the problem

Deploy the web applications with restricted and non-restricted access to separate IJServers.

Note: When the method is complete, if the request URI includes attack pattern strings, servlet service processes as follows.

• Servlet service based on Tomcat4.1:
  The HTTP status code becomes 500 in the response and the string "IJServer14795" is output to container.log.
• Servlet service based on Tomcat5.5:
  The HTTP status code becomes 404 in the response.

3. Corresponding system and Patch information

Corresponding system :GP7000F, PRIMEPOWER, PRIMERGY, GP5000, CELSIUS, FMV series, AT compatible machine, PRIMEQUEST

* For the Patches without ID nor link, please contact a Fujitsu system engineer or your partner(s).

4. Revision history

• March 3rd 2009: 2nd release
  • Description about Servlet Service based on Tomcat5.5 has been added to the "1. Background and Detected problem(s)" and "2. Method to temporarily avoid the problem".
  • Package names for the products listed below have been corrected from F3FMjs4 to F3FMjs5 in "3. Corresponding system and Patch information".
    "Interstage Studio Enterprise Edition 9.0.0 for Windows"
    "Interstage Studio Standard-J Edition 9.0.0 for Windows"
  • Some "Patch ID."s have been added in "3. Corresponding system and Patch information".
• September 6th, 2007 : Initial release